CVE-2007-3651

Technical details about CVE-2007-3651 are not publicly available in the provided documents; no product/version specifics are disclosed. Monitor for updates.

CVE-2007-3650

CVE-2007-3650 affects myWebland myBloggie 2.1.6. The vulnerability enables information disclosure through three vectors: (1) invalid year parameter to calendar.php via index.php, (2) direct request to common.php, and (3) a mode array parameter in the query string to login.php. These error message...

CVE-2007-3651

class/page.php in Farsi Script aka FaScript FaName 1.0 allows remote attackers to obtain sensitive information via a '; quote semicolon sequence in the id parameter, which reveals the installation path in an error message...

CVE-2008-3080

MyBloggie 2.1.6 (myWebland) is affected by two related issues. First, CVE-2008-3080 describes a CSRF vulnerability in admin.php that allows remote attackers to perform edit actions as administrators; this may enable combined or chained actions. Second, CVE-2007-1899 (and related records) document...

CVE-2007-3652

Farsi Script (aka FaScript) FaName 1.0 is affected by an SQL injection vulnerability in the class/page.php component. Remote attackers can exploit the id parameter to execute arbitrary SQL commands. Successful exploitation typically requires PHP magic_quotes_gpc to be set to Off on the server. Wh...

CVE-2007-3650

myWebland myBloggie 2.1.6 allow remote attackers to obtain sensitive information via 1 an invalid year parameter to calendar.php, reached through index.php; 2 a direct request to common.php; and 3 a mode array parameter in the query string to login.php, which reveal the installation path in vario...

CVE-2007-1899

CVE-2007-1899 affects myWebland myBloggie 2.1.6. It describes multiple SQL injection vulnerabilities: remote attackers can exploit user_id in viewuser (index.php) and post_id in edit (admin.php) to run arbitrary SQL commands; also note that authenticated administrators can abuse the post_id path....

CVE-2007-3653

CVE-2007-3653 concerns multiple XSS vulnerabilities in FaName 1.0 (FaScript/Farsi Script). The affected component is FaName 1.0’s web front end (index.php and page.php) where user-controlled inputs in the key, desc, and name parameters can be injected with arbitrary HTML/JS. The root cause is ins...

Security fix for the ALT Linux 10 package apache2 version 2.2.9-alt1

July 8, 2008 Aleksey Avdeev 2.2.9-alt1 - 2.2.9 - Security fixes CVE-2008-2364, CVE-2007-6420...

Fedora 8 : jetty-5.1.14-1jpp.1.fc8 (2008-6164)

Fri Jul 4 2008 Jeff Johnston 5.1.14-1jpp.1 - Security patch - Resolves 417401, 417411, 417391 - Upgrade to 5.1.14 source tarball for Fedora Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to...

Fedora 9 : jetty-5.1.14-1jpp.2.fc9 (2008-6141)

Bug 417411 - CVE-2007-5615: jetty CRLF injection - Bug 417391 - CVE-2007-5613: jetty cross site scripting - Bug 417401 - CVE-2007-5614: jetty session hijacking issue Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory...

GLSA-200807-01 : Python: Multiple integer overflows

The remote host is affected by the vulnerability described in GLSA-200807-01 Python: Multiple integer overflows Multiple vulnerabilities were discovered in Python: David Remahl reported multiple integer overflows in the file imageop.c, leading to a heap-based buffer overflow CVE-2008-1679. This...

Security fix for the ALT Linux 9 package apache2 version 2.2.9-alt1

July 8, 2008 Aleksey Avdeev 2.2.9-alt1 - 2.2.9 - Security fixes CVE-2008-2364, CVE-2007-6420...

Security fix for the ALT Linux 8 package apache2 version 2.2.9-alt1

July 8, 2008 Aleksey Avdeev 2.2.9-alt1 - 2.2.9 - Security fixes CVE-2008-2364, CVE-2007-6420...

Debian DSA-1601-1 : wordpress - several vulnerabilities

Several remote vulnerabilities have been discovered in Wordpress, the weblog manager. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2007-1599 WordPress allows remote attackers to redirect authenticated users to other websites and potentially obtain...

Design/Logic Flaw

Microsoft Crypto API 5.131.2600.2180 through 6.0, as used in Outlook, Windows Live Mail, and Office 2007, performs Certificate Revocation List CRL checks by using an arbitrary URL from a certificate embedded in a 1 S/MIME e-mail message or 2 signed document, which allows remote attackers to obtai...

CVE-2008-3068

Microsoft Crypto API 5.131.2600.2180 through 6.0, as used in Outlook, Windows Live Mail, and Office 2007, performs Certificate Revocation List CRL checks by using an arbitrary URL from a certificate embedded in a 1 S/MIME e-mail message or 2 signed document, which allows remote attackers to obtai...

CVE-2008-3068

Microsoft Crypto API 5.131.2600.2180 through 6.0, as used in Outlook, Windows Live Mail, and Office 2007, performs Certificate Revocation List CRL checks by using an arbitrary URL from a certificate embedded in a 1 S/MIME e-mail message or 2 signed document, which allows remote attackers to obtai...

CVE-2008-3068

Microsoft Crypto API 5.131.2600.2180 through 6.0 (used in Outlook, Windows Live Mail, and Office 2007) performs CRL checks by using an arbitrary URL from a certificate embedded in an S/MIME email or a signed document via the Authority Information Access (AIA) extension. This allows remote attacke...

CVE-2008-3068: Undefined Security Weakness

Microsoft Crypto API 5.131.2600.2180 through 6.0, as used in Outlook, Windows Live Mail, and Office 2007, performs Certificate Revocation List CRL checks by using an arbitrary URL from a certificate embedded in a 1 S/MIME e-mail message or 2 signed document, which allows remote attackers to obtai...